US state privacy notice

This notice is part of the TaleTykes Privacy policy. It is written for residents of US states that have consumer privacy laws, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Words such as "personal information", "personal data", "sale", "share", "targeted advertising", "profiling" and "sensitive data" have the meanings those laws give them.

TaleTykes, Inc. ("TaleTykes", "we") is the business (or "controller") for the personal information of the adults who use TaleTykes. For student information a school gives us, we act as the school's service provider (or "processor"), and the school decides how to answer requests about it. Information about children in family accounts is covered by the Notice for parents about children's information, and parents use the rights in this notice on their children's behalf.

Some of these laws apply only to businesses above a certain size, and many exempt data covered by FERPA or COPPA. We don't rely on those limits to turn down requests from our own account holders. We give the rights to know, get a copy, correct and delete to every account holder in the United States.

The short version

• We don't sell personal information. We don't share it for cross-context behavioral advertising. We don't use it for targeted advertising.
• We don't use personal information for profiling that produces legal or similarly significant effects.
• We use sensitive personal information only to provide the Service and keep it secure.
• You can ask to know, get a copy, correct or delete your information from the Privacy & data page in your family settings, or by emailing privacy@taletykes.com.
• If we say no, you can appeal, and then contact your state attorney general.
• We won't treat you differently for using any of these rights.

California notice at collection

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), asks businesses to describe, at or before the time they collect personal information, the categories they collect and why. The table below covers the last 12 months and what we expect to collect going forward. The "Disclosed to" column lists the categories of recipients to whom we disclose each category for a business purpose. We have not sold or shared any category in the last 12 months.

We don't collect biometric information, health information, financial account numbers (Stripe holds card numbers), government ids, precise location, racial or ethnic origin, religious beliefs, union membership, sexual orientation, or the contents of your mail, email or texts other than messages you send to us.

Sources

We collect personal information from you, from the devices you use, from sign-in providers you choose (Google and Apple), from Stripe, from your school or district and the rostering and learning services it connects, and from activity in TaleTykes itself. The Privacy policy describes each source.

Business purposes

We use personal information for these purposes, all of which the CCPA treats as business purposes: providing the Service you asked for; billing; communicating with you; keeping the Service secure and preventing fraud and misuse; fixing problems; meeting legal obligations; and improving the Service using our own records, in aggregate. We don't use it for any other commercial purpose.

Recipients

We disclose personal information to service providers and contractors who are bound by contracts that limit their use of it to the services they perform for us. The list of companies is on the Subprocessors page. We also disclose it to integrations that you or your school choose, and where the law requires. We don't disclose it to third parties for their own purposes.

We do not sell or share

In the CCPA, "sell" means disclosing personal information to a third party for money or other valuable consideration, and "share" means disclosing it to a third party for cross-context behavioral advertising. Other states use similar terms, along with "targeted advertising".

• We don't sell personal information, and we haven't in the last 12 months.
• We don't share personal information for cross-context behavioral advertising, and we haven't in the last 12 months.
• We don't use personal information for targeted advertising, and we don't allow advertising networks, data brokers, analytics companies or social networks to collect it on TaleTykes.
• We have no actual knowledge of selling or sharing the personal information of anyone under 16. We don't sell or share it, and we don't use it for targeted advertising, for anyone of any age.

Because we don't sell or share, we don't show a "Do Not Sell or Share My Personal Information" link. If our practices ever changed, we would update this notice first, add that link, and get the consents the law requires before doing so. We treat a Global Privacy Control signal as a valid opt-out request, as explained in the Privacy policy.

Sensitive personal information

We use sensitive personal information only for the purposes the CCPA allows without offering a right to limit: to provide the Service you asked for, to keep accounts and the Service secure, to prevent fraud and misuse, to meet legal duties, and to keep the Service working. We don't use it to infer characteristics about you. That is why there is no "Limit the Use of My Sensitive Personal Information" link.

In states that treat information about a known child as sensitive data (including Colorado, Connecticut, Virginia, Texas, Oregon, Montana and others), we process a child's personal data only as COPPA requires: with verifiable parental consent, or a school's consent for school use. The Notice for parents about children's information explains how that consent works.

Your rights

Rights most states give

Most state privacy laws give their residents the same core rights. Subject to the differences listed below, you can ask us to:

• Know and access. Confirm whether we process your personal information, and give you access to it. California residents can also ask for the categories of information, sources, purposes and recipients, and the specific pieces we hold.
• Get a copy. Give you a copy in a portable, readily usable format. Our download is a JSON file.
• Correct. Correct inaccurate personal information, taking into account the kind of information and why we use it.
• Delete. Delete personal information you provided or that we obtained about you, subject to the exceptions the law allows.
• Opt out. Stop selling your personal information, stop using it for targeted advertising, and stop profiling that produces legal or similarly significant effects. We don't do any of these, so there is nothing to stop, but we will confirm that if you ask.
• Not be discriminated against for using these rights.

You can use these rights for yourself, and, as a parent or legal guardian, for your child.

Where states differ

Because we don't sell, don't do targeted advertising, and don't do profiling with legal or similarly significant effects, the minors' consent rules and the profiling rights don't change what we do. Our reading skill estimates are used only to pick a child's next books and lessons and to show progress to the child's grown-ups and teachers. They don't decide anyone's access to school, services or opportunities, and an adult can see them at any time. If you live in Minnesota or Connecticut and want to question a skill estimate, write to privacy@taletykes.com; we will explain how it was reached, show you the data behind it, and correct it if the data was wrong.

Where these laws require it, we also carry out and keep data protection assessments for processing that presents a heightened risk, such as processing children's data.

How to submit a request

You can make a request in either of two ways:

• Signed in, from the Privacy & data page in your family settings (download or delete), or from your settings (correct). Teachers and school staff can use the email route.
• By email to privacy@taletykes.com. Please write from the email address on your account if you can, say which state you live in, and tell us what you are asking for.

TaleTykes is offered only online and we have a direct relationship with our account holders, so email and the in-app pages are our request methods. We don't take requests by phone.

Timing

We confirm we have received a request within 10 business days and answer within 45 days. Where the law allows, we may extend that once by up to 45 more days if we need to, and we will tell you why within the first 45 days. We answer requests free of charge. We may charge a reasonable fee, or decline, if requests from the same person are plainly unfounded, excessive or repetitive, and we will explain why.

Verification

We verify each request so we don't give anyone else's information, or a child's, to the wrong person.

• A request made while you are signed in is verified by your session. We may ask for a two-step check first.
• For an email request, we send a code or link to the email address on the account and ask you to confirm it. For a copy of the specific pieces of information, or for deletion, we may ask you to sign in.
• If you don't have an account, we will match the details you give us to what we hold. If we hold nothing, we will tell you.
• We use verification details only for verification and delete them when we're done.
• We don't need to verify a request to opt out, but we may ask for enough detail to apply it.

Authorized agents

You can use an authorized agent. The agent must give us your signed permission, or a valid power of attorney. Unless they hold a power of attorney, we may ask you to verify your own identity directly with us, or to confirm that you gave the agent permission. A business acting as an agent in California must be registered with the California Secretary of State. An agent can't make a request about a child's information without showing the authority of the child's parent or legal guardian.

Appeals

If we decline your request, in whole or in part, we will explain why and how to appeal. To appeal, reply to our answer or email privacy@taletykes.com with "Appeal" in the subject line within 60 days. Someone who was not involved in the first decision will review it, and we will tell you the result in writing within 45 days (or 60 days where state law allows), with our reasons.

Contacting your attorney general

If we deny your appeal, you may contact your state attorney general. Each state's attorney general has a consumer protection or privacy office that takes complaints online. In California, you may also contact the California Privacy Protection Agency. We will include this information in our appeal decision.

Non-discrimination

We won't discriminate against you for using any of your privacy rights. We won't deny you the Service, charge you a different price or rate, give you a different level or quality of service, or suggest that you will get any of these, because you used a right. We don't offer financial incentives, loyalty programs or price differences in return for personal information.

Some requests change what the Service can do. For example, if you delete your account or withdraw core consent for a child, we can no longer provide the Service for that account or child. That is a result of the deletion, not a penalty.

Children and teens

TaleTykes is used by children. Our handling of children's information follows COPPA and the Notice for parents about children's information. Under the state laws above:

• A parent or legal guardian makes privacy requests for a child under 13, and we verify the parent's authority.
• We don't sell or share the personal information of anyone under 18, use it for targeted advertising, or use it for profiling with legal or similarly significant effects.
• We collect only the information each child's space needs, which is how the Maryland minimization rule and similar rules expect it.
• For students, schools decide how to answer requests about education records, and we help them.

Request metrics

The CCPA requires businesses above a certain size to publish each year the number of requests they received, completed and denied, and how long they took to answer. We will publish these metrics on this page when we are required to. We keep records of every request and our answer for at least 24 months.

Washington My Health My Data

Washington's My Health My Data Act protects "consumer health data". We don't collect consumer health data. We don't ask about anyone's physical or mental health, health conditions, treatments, medications, or health care, and we don't infer health status from how a child reads. Display and reading settings, such as text size or read-aloud, are product settings, not health information. If you send us health information in a message, we use it only to answer you, and you can ask us to delete it.

Nevada

Nevada residents may ask a website operator not to sell certain personal information. We don't sell personal information as Nevada law defines it. You can still send an opt-out request to privacy@taletykes.com, and we will record it in case our practices ever change.

Changes to this notice

We review this notice at least once every 12 months and update it when our practices or the law change. The date at the top shows when it last changed. Material changes are handled as the Privacy policy describes.

Contact

Email privacy@taletykes.com with any question about this notice or your rights. For school records, schools can write to schools@taletykes.com. Our mailing address is available on request from legal@taletykes.com and is given in full in every school agreement.